Cybersecurity and Decision Makers

Marie de Fréminville is a non-executive director and founding partner of Starboard Advisory. She is also a member of the IFA (French Institute of non-executive Directors), HEC Governance and Swiss Association of Women Directors. In addition, de Fréminville is an expert in governance, financial performance, risk mapping and data protection.

• Foreword xiPreface xiiiIntroduction xviiChapter 1. An Increasingly Vulnerable World 11.1. The context 11.1.1. Technological disruptions and globalization 11.1.2. Data at the heart of industrial productivity 31.1.3. Cyberspace, an area without boundaries 31.1.4. IT resources 41.2. Cybercrime 41.2.1. The concept of cybercrime 41.2.2. Five types of threats 61.2.3. Five types of attackers 91.3. The cybersecurity market 151.3.1. The size of the market and its evolution 151.3.2. The market by sector of activity 151.3.3. Types of purchases and investments 161.3.4. Geographical distribution 171.4. Cyber incidents 171.4.1. The facts 171.4.2. Testimonials versus silence 241.4.3. Trends 251.4.4. Examples 271.5. Examples of particularly exposed sectors of activity 301.5.1. Cinema 301.5.2. Banks 311.5.3. Health 341.5.4. Tourism and business hotels 351.5.5. Critical national infrastructure 361.6. Responsibilities of officers and directors 37Chapter 2. Corporate Governance and Digital Responsibility 392.1. Corporate governance and stakeholders 392.2. The shareholders 402.2.1. Valuation of the company 412.2.2. Cyber rating agencies 422.2.3. Insider trading 432.2.4. Activist shareholders 442.2.5. The stock exchange authorities 452.2.6. The annual report 452.3. The board of directors472.3.1. The facts 472.3.2. The four missions of the board of directors. 472.3.3. Civil and criminal liability 492.3.4. The board of directors and cybersecurity 502.3.5. The board of directors and data protection 532.3.6. The statutory auditors 542.3.7. The numerical responsibility of the board of directors 552.4. Customers and suppliers 562.5. Operational management 582.5.1. The impacts of digital transformation 582.5.2. The digital strategy 592.5.3. The consequences of poor digital performance 622.5.4. Cybersecurity 632.5.5. Merger and acquisition transactions 652.5.6. Governance and data protection, cybersecurity 66Chapter 3. Risk Mapping 693.1. Cyber-risks 693.2. The context 713.3. Vulnerabilities 723.3.1. Fraud against the president 733.3.2. Supplier fraud 733.3.3. Other economic impacts 743.4. Legal risks 763.4.1. Class actions 763.4.2. Sanctions by the CNIL and the ICO 773.5. The objectives of risk mapping 783.6. The different methods of risk analysis 793.7. Risk assessment (identify) 813.7.1. The main actors 813.7.2. The steps 823.8. Protecting 833.9. Detecting 833.10. Reacting 843.11. Restoring 853.12. Decentralized mapping 853.12.1. The internal threat 853.12.2. Industrial risks 873.12.3. Suppliers, subcontractors and service providers 883.12.4. Connected objects 893.13. Insurance 943.14. Non-compliance risks and ethics 96Chapter 4. Regulations 994.1. The context 994.1.1. Complaints filed with the CNIL 1004.1.2. Vectaury 1014.1.3. Optical Center 1024.1.4. Dailymotion 1034.2. The different international regulations (data protection) 1034.2.1. The United States 1044.2.2. China 1044.2.3. Asia 1054.2.4. Europe 1054.3. Cybersecurity regulations, the NIS Directive 1054.4. Sectoral regulations 1064.4.1. The banking industry 1064.4.2. Health 1084.5. The General Data Protection Regulation (GDPR) 1094.5.1. The foundations 1104.5.2. Definition of personal data 1104.5.3. The so-called “sensitive” data 1114.5.4. The principles of the GDPR 1124.5.5. The five actions to be in compliance with the GDPR 1134.5.6. The processing register 1134.5.7. The five actions to be carried out 1134.5.8. Cookies 1164.6. Consequences for the company and the board of directors 117Chapter 5. Best Practices of the Board of Directors 1195.1. Digital skills 1205.2. Situational awareness 1215.2.1. The main issues 1215.2.2. Insurance 1255.3. Internal governance 1265.3.1. The CISO 1265.3.2. The CISO and the company 1275.3.3. Clarifying responsibilities 1315.3.4. Streamlining the supplier portfolio 1335.3.5. Security policies and procedures 1345.3.6. The human being 1375.4. Data protection 1385.4.1. Emails 1395.4.2. The tools 1415.4.3. Double authentication: better, but not 100% reliable 1425.5. Choosing your service providers 1425.6. The budget 1435.7. Cyberculture 1445.8. The dashboard for officers and directors 145Chapter 6. Resilience and Crisis Management 1476.1. How to ensure resilience? 1476.2. Definition of a CERT 1496.3. Definition of a SOC 1496.4. The role of ENISA 1506.5. The business continuity plan 1506.6. Crisis management 1516.6.1. The preparation 1516.6.2. Exiting the state of sideration 1526.6.3. Ensuring business continuity 1536.6.4. Story of the TV5 Monde attack 1546.6.5. Management of the first few hours 1596.7. Crisis simulation 163Conclusion. The Digital Committee 165Appendices 167Appendix 1. Cybersecurity Dashboard 169Appendix 2. Ensuring Cybersecurity in Practice and on a Daily Basis 173Appendix 3. Tools to Identify, Protect, Detect, Train, React and Restore 175Glossary 179References 183Index 187